Directory Traversal

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Directory Traversal in the ensurePathIsContained function. An attacker can potentially access files outside the intended directory by manipulating file paths during the normalization process...

Protection Mechanism Failure

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Protection Mechanism Failure through the SecurityPolicy process. An attacker can execute arbitrary code on the server by rendering a malicious Twig template after authenticating to the contro...

PT-2026-70200

Name of the Vulnerable Software and Affected Versions Craft CMS versions 5.0.0-RC1 through 5.10.5 Craft CMS versions 4.0.0-RC1 through 4.18.1 Description Authenticated users with control panel access can leak arbitrary environment variables and secrets. This occurs because the software interpolat...

Exploit for Code Injection in Craftcms Craft_Cms

bash payload=$printf %s "bash -c...

CLSA-2026-1784077481 TuxCare security update for craftcms/cms (3 CVEs)

TuxCare rebuilt craftcms/cms to address 3 CVEs. Fixed in 3.9.15-p6+tuxcare...

CLSA-2026-1783386121 TuxCare security update for craftcms/cms (1 CVE)

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p4+tuxcare...

CLSA-2026-1774313530 TuxCare security update for craftcms/cms (10 CVEs)

TuxCare rebuilt craftcms/cms to address 10 CVEs. Fixed in 3.9.15-p1+tuxcare...

CLSA-2026-1776904647 TuxCare security update for craftcms/cms (3 CVEs)

TuxCare rebuilt craftcms/cms to address 3 CVEs. Fixed in 3.9.15-p3+tuxcare...

PT-2026-75422

TuxCare rebuilt craftcms/cms to address 3 CVEs. Fixed in 3.9.15-p6+tuxcare...

PT-2026-75570

TuxCare rebuilt craftcms/cms to address 14 CVEs. Fixed in 3.9.15-p7+tuxcare...

PT-2026-75378

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p5+tuxcare...

PT-2026-75317

TuxCare rebuilt craftcms/cms to address 1 CVE. Fixed in 3.9.15-p4+tuxcare...

PT-2026-74562

TuxCare rebuilt craftcms/cms to address 3 CVEs. Fixed in 3.9.15-p3+tuxcare...

PT-2026-74443

TuxCare rebuilt craftcms/cms to address 2 CVEs. Fixed in 3.9.15-p2+tuxcare...

PT-2026-74105

TuxCare rebuilt craftcms/cms to address 10 CVEs. Fixed in 3.9.15-p1+tuxcare...

Arbitrary Code Injection

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Arbitrary Code Injection in the actionRenderCardPreview process. An attacker can execute arbitrary PHP code and disclose sensitive information by injecting malicious event handlers into the...

Directory Traversal

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Directory Traversal via the actionIcon process. An attacker can access arbitrary local .svg files by supplying crafted traversal sequences in the extension parameter, allowing disclosure of...

Arbitrary Code Injection

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Arbitrary Code Injection in the renderObjectTemplate process. An attacker can execute arbitrary code by supplying malicious input in the HTTP Referer header when saving entries in the control...

Improper Authorization

Overview craftcms/cms is a content management system. Affected versions of this package are vulnerable to Improper Authorization in the entries/save-entry process. An attacker can reassign content authorship to another user without proper authorization by submitting crafted requests containing...

CVE-2026-56382: Improper Control of Generation of Code

Craft CMS composer package craftcms/cms versions = 5.5.0 and = 5.9.13 contain a remote code execution vulnerability in the FieldsController::actionRenderCardPreview method, which passes the fieldLayoutConfig POST parameter directly to Fields::createLayout without calling Component::cleanseConfig...